From c254e5a72dfda26b4d40ac63a9bd05d8e63c1199 Mon Sep 17 00:00:00 2001 From: Eric Conrad Date: Thu, 7 Sep 2017 19:40:08 -0400 Subject: [PATCH] Update DeepWhite.md --- DeepWhite.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/DeepWhite.md b/DeepWhite.md index ba63337..75b987a 100644 --- a/DeepWhite.md +++ b/DeepWhite.md @@ -34,10 +34,11 @@ Note that hashdeep, etc., has a dumb recursive design (from the manpage): > Enables recursive mode. All subdirectories are traversed. Please note that recursive mode cannot be used to examine all files of a given file extension. For example, calling hashdeep -r *.txt will examine all files in directories that end in .txt. On Linux/Unix: create a new CSV with the proper header (required by PowerShell's ConvertFrom-Csv), take the raw CSV, remove the carriage returns, select DLLs, EXEs and SYS files, grab the 2nd field to the end, and append to the new CSV: -```shell -Todo: add PowerShell instructions to do this on Windows. Contributions welcome! +```shell $ echo "md5,sha1,sha256,path" > file-whitelist.csv $ cat raw-hashes.csv | tr -d '\r' | egrep "\.dll$|\.exe$|\.sys$" | cut -d, -f2- >> file-whitelist.csv ``` +Todo: add PowerShell instructions to do this on Windows. Contributions welcome! +